feat(boundaries): WP-04 — ui ↛ infrastructure + showcase sanction

Move the two wizard lookups behind application-layer facades so ui/ no longer
injects infrastructure adapters directly:
- RegistratieLookupStore (BRP address + DUO diplomas): owns the resources,
  runs the trust-boundary parse, exposes adresStatus/prefillAdres/duoLookup.
- IntakePolicyStore (scholing threshold): owns the policy resource, exposes
  the derived threshold.

Add the lint rule ui/ + layout/ ↛ **/infrastructure/** (@typescript-eslint
variant so it composes with the base direction rules; stories/specs exempted
as test scaffolding). Add the documented showcase sanction (may read every
context). Fix the docs' inventory: 6 contexts / 5 layers, +brief, +contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/backlog/WP-04-ui-not-infrastructure.md

@@ -1,6 +1,6 @@
 # WP-04 — Boundaries II: `ui ↛ infrastructure` + showcase sanction
 
-Status: todo
+Status: done (pending commit)
 Phase: 0 — enforcement & gates
 
 ## Why
@@ -54,11 +54,13 @@ Phase 0 — a pure move of wiring, no behavior change.
 
 ## Acceptance criteria
 
-- [ ] Rule active; lint green; no disables beyond the documented showcase + debug-state
-      exemptions.
-- [ ] No `**/ui/**` file imports from `**/infrastructure/**`.
-- [ ] Both wizards behave unchanged (specs pass; manual smoke).
-- [ ] CLAUDE.md and ARCHITECTURE.md list 6 contexts / 5 layers.
+- [x] Rule active; lint green; no disables beyond the documented showcase + debug-state
+      exemptions. (Probed: a ui→infra import errors.)
+- [x] No `**/ui/**` file imports from `**/infrastructure/**` (production; stories/specs
+      exempted — test scaffolding wires the real client).
+- [x] Both wizards behave unchanged (178 specs pass; storybook a11y suite mounts both
+      wizards green — behaviour is a pure wiring move behind root facades).
+- [x] CLAUDE.md and ARCHITECTURE.md list 6 contexts / 5 layers.
 
 ## Verification